Abstract: A computer system is configured to generate alerts related to malicious activity on an audited computing system. The computing system is provided with instructions to receive activity information associated with activity of an entity performed in an audited computing network, access contextual information associated with the entity, determine, based on the contextual information, a set of weights associated with the activity information and combine the weight and the entity activity information to generate a risk score. In response to the risk score satisfying a threshold value, the computer system may generate an alert, and, in response to receiving a user input associated with the alert, update the set of weights. In certain embodiments, the updated weights may be used for determining the risk score of future alerts.

Abstract: Systems and methods for live reindexing include receiving, at a dispatch server, a request to reindex a database, wherein, at the time the request to reindex is received, the dispatch server is configured to send queries for information in the database to a first index server, the first index server comprising a first index of information in the database. The systems and methods further include, responsive to receiving the request to reindex and while the database is live, generating a second index of the information in the database, storing the second index at a second index server, and configuring the dispatch server to use the second index server as a live index server and to no longer use the first index server as a live index server.

Abstract: Embodiments of the present disclosure relate to user interfaces and systems that may enable dynamic and interactive access of, investigation of, and analysis of data objects stored in one or more databases. The data objects may be accessed from the one or more databases, and presented in multiple related portions of a display. In particular, the system provides a time-based visualization of data objects (and/or properties associated with the data objects) to a user such that the user may, for example, determine connections between various data objects, observe flows of information among data objects, and/or investigate related data objects.

Abstract: A system including first computer memory storing a full data set representable in rows and columns, a second computer memory storing executable instructions, and processors configured to execute the instructions to cause presentation of data of the full data set on a display including columns of data each having data fields, receive user input identifying a column of the data set, determine items to modify in information in the data fields of the identified column, generate and cause display of an indication of a proposed change action to modify the determined items, and in response to a user input indicating a selection of the indication of the proposed change action, update the presentation of the data based on the change action to modify information displayed in the data fields of the identified column of the data, and store a log of the change action.

Abstract: The systems, methods, and devices of the present disclosure may provide, among other features, high-performance, interactive geographical and/or data object map capabilities in which large amounts of geographical, geospatial, and other types of data, geodata, objects, features, and/or metadata are efficiently presented to a user on a map interface. In various embodiments, an interactive geographical map display system may enable rapid and deep analysis of various objects, features, and/or metadata by the user by aggregating and clustering large sets of data into aggregate values and clusters. The user can select various clusters, via the user interface, to interact with the data, clusters, and map.

Abstract: Systems and methods for adaptive and transparent entity screening are provided. In an aspect, a first entity list comprising a plurality of first entity records is accessed. The first entity records comprise a plurality of first entity identifying attributes. A second entity list comprising a plurality of second entity records is also accessed, wherein the second entity records comprise a plurality of second entity identifying attributes. In certain aspects, an entity screening model pairs the first entity identifying attributes of the first entity record with the second entity identifying attributes of the second entity record, executes different matching algorithms on pairs of entity identifying attributes, and determines an overall likelihood that the pair of entity records are a match based on aggregation of match scores from the plurality of matching algorithms.

Abstract: Aspects of the present disclosure relate to performing agnostic data integrity checks on source data, and based on the data integrity checks, generating a human-readable report that may be useable to identify specific errors or anomalies within the source data. Example embodiments involve systems and methods for performing the data integrity checks and generating the human-readable reports. For example, the method may include operations to ingest data from a source database through a data pipeline and into a local database, access the data from the data pipeline, determine a data type of the data, determine subtypes of data elements which make up the data, determine a count of each subtype, and generate a human-readable report, to be displayed at a client device.

Abstract: Systems and methods are provided for improved time series databases and time series operations. A time series service responds to requests from external devices. The external devices request time series data and submit time series queries. The time series service generates planned and efficient time series queries from the initial queries. The time series service performs operations such as unit conversion, interpolation, and performing operations on time series data. The time series service can identify which time series database to query from and/or cause data to be populated into a time series database from a data pipeline system.

Abstract: Systems and methods are provided for providing continuous configuration deployment. A configuration definition object may be obtained from a remote datastore. The obtained configuration definition object may be stored in a local datastore. The configuration definition object may be obtained and stored in advance of a scheduled maintenance. The configuration definition object may be obtained in response to the configuration definition object being committed to the remote datastore. The configuration definition object may be used to generate different configuration objects. A configuration object may be generated from the configuration definition object and one or more system characteristics. A service request may be received, and the configuration object may be executed to perform a configuration of a computing system.

Abstract: Data item deltas are generated for each of M updates of a plurality of updates, wherein M is greater than or equal to one, and a first first-level combined delta is generated representing N updates of the plurality of updates, wherein N is greater than M, and the N updates comprise the M updates and O=N?M other updates. A first second-level combined delta is generated representing J updates of the plurality of updates, wherein J is greater than N, and the J updates comprise the N updates and K other updates of the plurality of updates, wherein K=J?N. The deltas, the first first-level combined delta and the first second-level combined delta are stored for enabling subsequent reading of at least part of the data by accessing the data item, the first first-level combined delta and the first second-level combined delta.

Abstract: A system may determine one or more data sources which the system is configured to access. The system may provide a set of application programming interfaces (APIs) for interacting with data stored in one or more data sources. The APIs may be accessible to one or more web applications which the system is configured to serve. The system may determine that a web application has requested an operation for interacting with the data through one or more APIs in the set of APIs. The system may determine one or more responses based at least in part on the operation requested by the web application. The system may provide the response(s) to the web application.

Abstract: Described herein are systems, methods, and non-transitory computer readable media for defining and executing functions for determining a matching entity that is relevant to an entity of interest when, for example, there is a significant number of intermediary links and entities between the matching entity and the entity of interest. A visual depiction of a path traversal from a seed input entity to an output matched entity can be presented to an end user in a manner that allows the end user to ascertain the sequence of intermediary links and entities that connect the matched entity to the seed entity.

Abstract: A data analysis system is proposed for providing fine-grained low latency access to high volume input data from possibly multiple heterogeneous input data sources. The input data is parsed, optionally transformed, indexed, and stored in a horizontally-scalable key-value data repository where it may be accessed using low latency searches. The input data may be compressed into blocks before being stored to minimize storage requirements. The results of searches present input data in its original form. The input data may include access logs, call data records (CDRs), e-mail messages, etc. The system allows a data analyst to efficiently identify information of interest in a very large dynamic data set up to multiple petabytes in size. Once information of interest has been identified, that subset of the large data set can be imported into a dedicated or specialized data analysis system for an additional in-depth investigation and contextual analysis.

Abstract: Systems and methods provide a first group of computation modules configured to provide back-end compute resources for a first type of computation module by back-end compute resources. Systems and methods provide a second group of computation modules that are configured to provide back-end compute resources for a second type of computation module wherein the first and second type of computation modules are of different types. In some examples, methods and systems identify the type of computation module needed by each of a plurality of queries associated with different types of client applications based on computation module type data associated with each query and route each of the plurality of queries to an appropriate computation module within the first or second computation modules based on the computation module type data. Related methods are also disclosed.

Abstract: Computer implemented systems and methods are disclosed for automatically clustering and canonically identifying related data in various data structures. Data structures may include a plurality of records, wherein each record is associated with a respective entity. In accordance with some embodiments, the systems and methods further comprise identifying clusters of records associated with a respective entity by grouping the records into pairs, analyzing the respective pairs to determine a probability that both members of the pair relate to a common entity, and identifying a cluster of overlapping pairs to generate a collection of records relating to a common entity. Clusters may further be analyzed to determine canonical names or other properties for the respective entities by analyzing record fields and identifying similarities.

Abstract: A system and method for creating a dynamic electronic form are described. The system may include one or more processors that cause the system to perform create an electronic form with one or more data entry fields. The system may also obtain access to a plurality of datasets, where each dataset may include multiple entry fields and integrate at least one identified dataset with the electronic form. The system may further suggest at least one data input in the data entry field based on information input in the data entry field by a user. The data entry input suggested may be sourced from the identified dataset integrated to the electronic form.

Abstract: Systems, methods, and non-transitory computer readable media are provided for facilitating improved analysis of remedial actions for faults. Fault information may be obtained. The fault information may characterize a fault of a device. The fault may be clustered into a fault type based on the fault information. A set of remedial actions taken for the fault type may be identified. A set of remedial effects of the set of remedial actions for the fault type may be determined. A timeline view of the fault type may be generated based on the set of remedial actions and the set of remedial effects. The timeline view may include a visual representation of effectiveness of the set of remedial actions. An interface, through which the timeline view of the fault type is accessible, may be provided.

Abstract: Systems and methods are provided for analyzing data snippets. One or more snippets can be associated with a data object of an enterprise data platform. The one or more snippets can be organized based on metadata information associated with the one or more snippets. The organized snippets can be analyzed to determine an activity relating to an entity depicted in the one or more snippets.

Abstract: A system architecture can be used to facilitate communication among applications that are native and/or non-native to an application environment. The system architecture can include a first application environment executed on a client-side computing device. The first application environment can execute software applications that are native thereto. The first application environment can further execute software applications that are native thereto, but which software applications themselves comprise second application environments of types different from the first application environment, and which software applications can therefore execute additional software applications that are non-native to the first application environment. The first application environment can further execute a computation engine that is configured to store and execute instructions received from the first software application, the second software application, or both.